---
title: "Complete Settings Flow"
method: POST
path: "/self-service/settings"
tags: ["frontend"]
---

# Complete Settings Flow

`POST /self-service/settings`

Use this endpoint to complete a settings flow by sending an identity's updated password. This endpoint
behaves differently for API and browser flows.

API-initiated flows expect `application/json` to be sent in the body and respond with
HTTP 200 and an application/json body with the session token on success;
HTTP 303 redirect to a fresh settings flow if the original flow expired with the appropriate error messages set;
HTTP 400 on form validation errors.
HTTP 401 when the endpoint is called without a valid session token.
HTTP 403 when `selfservice.flows.settings.privileged_session_max_age` was reached or the session's AAL is too low.
Implies that the user needs to re-authenticate.

Browser flows without HTTP Header `Accept` or with `Accept: text/*` respond with
a HTTP 303 redirect to the post/after settings URL or the `return_to` value if it was set and if the flow succeeded;
a HTTP 303 redirect to the Settings UI URL with the flow ID containing the validation errors otherwise.
a HTTP 303 redirect to the login endpoint when `selfservice.flows.settings.privileged_session_max_age` was reached or the session's AAL is too low.

Browser flows with HTTP Header `Accept: application/json` respond with
HTTP 200 and a application/json body with the signed in identity and a `Set-Cookie` header on success;
HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
HTTP 401 when the endpoint is called without a valid session cookie.
HTTP 403 when the page is accessed without a session cookie or the session's AAL is too low.
HTTP 400 on form validation errors.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called with a `Accept: application/json` HTTP header, the response contains the flow without a redirect. In the
case of an error, the `error.id` of the JSON response body can be one of:

`session_refresh_required`: The identity requested to change something that needs a privileged session. Redirect
the identity to the login init endpoint with query parameters `?refresh=true&return_to=<the-current-browser-url>`,
or initiate a refresh login flow otherwise.
`security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
`session_inactive`: No Ory Session was found - sign in a user first.
`security_identity_mismatch`: The flow was interrupted with `session_refresh_required` but apparently some other
identity logged in instead.
`security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!
`browser_location_change_required`: Usually sent when an AJAX request indicates that the browser needs to open a specific URL.
Most likely used in Social Sign In flows.

More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).

## Query parameters

- `flow` string, required

## Headers

- `X-Session-Token` string
- `Cookie` string

## Request body

- union — Update Settings Flow Request Body
  - UpdateSettingsFlowWithPasswordMethod — Update Settings Flow with Password Method
    - `csrf_token` string — CSRFToken is the anti-CSRF token
    - `method` string, required — Method Should be set to password when trying to update a password.
    - `password` string, required — Password is the updated password
  - UpdateSettingsFlowWithProfileMethod — nolint:deadcode,unused
    - `csrf_token` string — The Anti-CSRF Token This token is only required when performing browser flows.
    - `method` string, required — Method Should be set to profile when trying to update a profile.
    - `traits` object, required — Traits The identity's traits.
  - UpdateSettingsFlowWithOidcMethod — nolint:deadcode,unused
    - `flow` string — Flow ID is the flow's ID. in: query
    - `link` string — Link this provider Either this or `unlink` must be set. type: string in: body
    - `method` string, required — Method Should be set to profile when trying to update a profile.
    - `traits` object — The identity's traits in: body
    - `unlink` string — Unlink this provider Either this or `link` must be set. type: string in: body
  - UpdateSettingsFlowWithOidcMethod — nolint:deadcode,unused
    - `flow` string — Flow ID is the flow's ID. in: query
    - `link` string — Link this provider Either this or `unlink` must be set. type: string in: body
    - `method` string, required — Method Should be set to profile when trying to update a profile.
    - `traits` object — The identity's traits in: body
    - `unlink` string — Unlink this provider Either this or `link` must be set. type: string in: body
  - UpdateSettingsFlowWithTotpMethod — Update Settings Flow with TOTP Method
    - `csrf_token` string — CSRFToken is the anti-CSRF token
    - `method` string, required — Method Should be set to "totp" when trying to add, update, or remove a totp pairing.
    - `totp_code` string — ValidationTOTP must contain a valid TOTP based on the
    - `totp_unlink` boolean — UnlinkTOTP if true will remove the TOTP pairing, effectively removing the credential. This can be used to set up a new TOTP device.
  - UpdateSettingsFlowWithWebAuthnMethod — Update Settings Flow with WebAuthn Method
    - `csrf_token` string — CSRFToken is the anti-CSRF token
    - `method` string, required — Method Should be set to "webauthn" when trying to add, update, or remove a webAuthn pairing.
    - `webauthn_register` string — Register a WebAuthn Security Key It is expected that the JSON returned by the WebAuthn registration process is included here.
    - `webauthn_register_displayname` string — Name of the WebAuthn Security Key to be Added A human-readable name for the security key which will be added.
    - `webauthn_remove` string — Remove a WebAuthn Security Key This must contain the ID of the WebAuthN connection.
  - UpdateSettingsFlowWithLookupMethod — Update Settings Flow with Lookup Method
    - `csrf_token` string — CSRFToken is the anti-CSRF token
    - `lookup_secret_confirm` boolean — If set to true will save the regenerated lookup secrets
    - `lookup_secret_disable` boolean — Disables this method if true.
    - `lookup_secret_regenerate` boolean — If set to true will regenerate the lookup secrets
    - `lookup_secret_reveal` boolean — If set to true will reveal the lookup secrets
    - `method` string, required — Method Should be set to "lookup" when trying to add, update, or remove a lookup pairing.

## Response `200`

settingsFlow

- SettingsFlow — This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.
  - `id` string, uuid, required — ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id>
  - `identity` Identity, required — An [identity](https://www.ory.sh/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory.
    - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
    - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
    - `id` string, uuid, required — ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB.
    - `metadata_admin` unknown
    - `metadata_public` unknown
    - `recovery_addresses` RecoveryIdentityAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `id` string, uuid, required
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `state` 'active' | 'inactive' — The state can either be `active` or `inactive`.
    - `state_changed_at` string, date-time
    - `traits` unknown, required
    - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
    - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `created_at` string, date-time — When this entry was created
      - `id` string, uuid — The ID
      - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
      - `updated_at` string, date-time — When this entry was last updated
      - `value` string, required — The address value example foo@user.com
      - `verified` boolean, required — Indicates if the address has already been verified
      - `verified_at` string, date-time
      - `via` string, required — VerifiableAddressType must not exceed 16 characters as that is the limitation in the SQL Schema
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow occurred.
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `return_to` string — ReturnTo contains the requested return_to URL.
  - `state` 'show_form' | 'success', required — show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings flow has been updated successfully with the provided data. Done will stay true when repeatedly checking. If set to true, done will revert back to false only when a flow with invalid (e.g. "please use a valid phone number") data was sent.
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` union, required
        - UiNodeInputAttributes — InputAttributes represents the attributes of an input node
          - `autocomplete` 'email' | 'tel' | 'url' | 'current-password' | 'new-password' | 'one-time-code' — The autocomplete attribute for the input. email InputAttributeAutocompleteEmail tel InputAttributeAutocompleteTel url InputAttributeAutocompleteUrl current-password InputAttributeAutocompleteCurrentPassword new-password InputAttributeAutocompleteNewPassword one-time-code InputAttributeAutocompleteOneTimeCode
          - `disabled` boolean, required — Sets the input's disabled field to true or false.
          - `label` UiText
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
          - `name` string, required — The input's element name.
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "input".
          - `onclick` string — OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn.
          - `pattern` string — The input's pattern.
          - `required` boolean — Mark this input field as required.
          - `type` 'text' | 'password' | 'number' | 'checkbox' | 'hidden' | 'email' | 'tel' | 'submit' | 'button' | 'datetime-local' | 'date' | 'url', required — The input's element type. text InputAttributeTypeText password InputAttributeTypePassword number InputAttributeTypeNumber checkbox InputAttributeTypeCheckbox hidden InputAttributeTypeHidden email InputAttributeTypeEmail tel InputAttributeTypeTel submit InputAttributeTypeSubmit button InputAttributeTypeButton datetime-local InputAttributeTypeDateTimeLocal date InputAttributeTypeDate url InputAttributeTypeURI
          - `value` unknown
        - UiNodeTextAttributes
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "text".
          - `text` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
        - UiNodeImageAttributes
          - `height` integer, required — Height of the image
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "img".
          - `src` string, required — The image's source URL. format: uri
          - `width` integer, required — Width of the image
        - UiNodeAnchorAttributes
          - `href` string, required — The link's href (destination) URL. format: uri
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "a".
          - `title` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
        - UiNodeScriptAttributes
          - `async` boolean, required — The script async type
          - `crossorigin` string, required — The script cross origin policy
          - `id` string, required — A unique identifier
          - `integrity` string, required — The script's integrity hash
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "script".
          - `nonce` string, required — Nonce for CSP A nonce you may want to use to improve your Content Security Policy. You do not have to use this value but if you want to improve your CSP policies you may use it. You can also choose to use your own nonce value!
          - `referrerpolicy` string, required — The script referrer policy
          - `src` string, required — The script source
          - `type` string, required — The script MIME type
      - `group` 'default' | 'password' | 'oidc' | 'profile' | 'link' | 'code' | 'totp' | 'lookup_secret' | 'webauthn', required — Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `meta` UiNodeMeta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `type` 'text' | 'input' | 'img' | 'a' | 'script', required — The node's type text Text input Input img Image a Anchor script Script

## Other responses

- `303` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201.
- `400` — settingsFlow
- `401` — errorGeneric
- `403` — errorGeneric
- `410` — errorGeneric
- `422` — errorBrowserLocationChangeRequired
- `default` — errorGeneric

## Changes

- **2022-12-02** `b6e5ffa30d4c` — 16 breaking, 62 warning, 20 info
  - removed `#/components/schemas/submitSelfServiceSettingsFlowWithPasswordMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithProfileMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithOidcMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithOidcMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithTotpMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithWebAuthnMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithLookupMethodBody` from the request body `oneOf` list (media type: application/json)
  - removed `#/components/schemas/submitSelfServiceSettingsFlowWithPasswordMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithProfileMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithOidcMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithOidcMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithTotpMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithWebAuthnMethodBody, #/components/schemas/submitSelfServiceSettingsFlowWithLookupMethodBody` from the request body `oneOf` list (media type: application/x-www-form-urlencoded)
  - the response property `identity/metadata_admin` became nullable for the status `200`
  - the response property `identity/metadata_admin` became nullable for the status `400`
  - …94 more
- …earlier changes not shown

[Full history](https://skmtc.dev/ory/apis/ory-identities-api/changes/self-service/settings/post.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/b6e5ffa30d4c/schema)